Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5577 vulnerabilities reference this CWE, most recent first.
GHSA-4C52-GF37-2PFP
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2022-05-13 01:47
VLAI
Details
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-8907"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-14T20:29:00Z",
"severity": "HIGH"
},
"details": "Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.",
"id": "GHSA-4c52-gf37-2pfp",
"modified": "2022-05-13T01:47:46Z",
"published": "2022-05-13T01:47:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8907"
},
{
"type": "WEB",
"url": "https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-06-14-907283498.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99090"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4C8G-JVCX-V4HV
Vulnerability from github – Published: 2026-06-16 19:04 – Updated: 2026-06-16 19:04
VLAI
Summary
Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
Details
Summary
In Deno, environment access is gated by the env permission. You can deny it
with --deny-env, or restrict it to a specific allowlist with
--allow-env=FOO,BAR. The expectation is that a program running without env
permission cannot change process.env.
process.loadEnvFile() (the Node-compatible API for loading variables from a
.env file) does not honor this. It only checks that the program has
read permission for the dotenv file, then writes every key in that file
into the process environment — even when env access is denied.
In effect, --allow-read plus a writable or attacker-controlled .env file
is enough to defeat --deny-env.
Am I affected?
You are potentially affected if all of the following are true:
- You run Deno v2.3.0 or newer.
- Your program (or any dependency it imports) calls
process.loadEnvFile()fromnode:process. - You rely on Deno's permission model — specifically
--deny-env, an--allow-env=…allowlist, or running without grantingenv— as a security boundary. - The
.envpath passed toloadEnvFile()can be controlled or modified by a less-trusted party (untrusted input, user-writable directory, third-party dependency, etc.) and is covered by your--allow-readgrant.
If your program does not use process.loadEnvFile() at all, or if it already
grants full env access, this advisory does not change your risk.
Severity
5.2 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.8.0"
},
"package": {
"ecosystem": "crates.io",
"name": "deno"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-49983"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-16T19:04:57Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nIn Deno, environment access is gated by the `env` permission. You can deny it\nwith `--deny-env`, or restrict it to a specific allowlist with\n`--allow-env=FOO,BAR`. The expectation is that a program running without `env`\npermission cannot change `process.env`.\n\n`process.loadEnvFile()` (the Node-compatible API for loading variables from a\n`.env` file) does **not** honor this. It only checks that the program has\n**read** permission for the dotenv file, then writes every key in that file\ninto the process environment \u2014 even when `env` access is denied.\n\nIn effect, **`--allow-read` plus a writable or attacker-controlled `.env` file\nis enough to defeat `--deny-env`.**\n\n## Am I affected?\n\nYou are potentially affected if **all** of the following are true:\n\n1. You run Deno **v2.3.0 or newer**.\n2. Your program (or any dependency it imports) calls `process.loadEnvFile()`\n from `node:process`.\n3. You rely on Deno\u0027s permission model \u2014 specifically `--deny-env`, an\n `--allow-env=\u2026` allowlist, or running without granting `env` \u2014 as a\n security boundary.\n4. The `.env` path passed to `loadEnvFile()` can be controlled or modified by\n a less-trusted party (untrusted input, user-writable directory, third-party\n dependency, etc.) and is covered by your `--allow-read` grant.\n\nIf your program does not use `process.loadEnvFile()` at all, or if it already\ngrants full `env` access, this advisory does not change your risk.",
"id": "GHSA-4c8g-jvcx-v4hv",
"modified": "2026-06-16T19:04:57Z",
"published": "2026-06-16T19:04:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/denoland/deno/security/advisories/GHSA-4c8g-jvcx-v4hv"
},
{
"type": "PACKAGE",
"url": "https://github.com/denoland/deno"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access"
}
GHSA-4CF5-XMHP-3XJ7
Vulnerability from github – Published: 2022-06-30 00:00 – Updated: 2022-07-11 19:25
VLAI
Summary
Improper Authorization in Apache Shiro
Details
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.shiro:shiro-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-32532"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-06T19:52:31Z",
"nvd_published_at": "2022-06-29T00:15:00Z",
"severity": "CRITICAL"
},
"details": "Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.",
"id": "GHSA-4cf5-xmhp-3xj7",
"modified": "2022-07-11T19:25:50Z",
"published": "2022-06-30T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32532"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/shiro"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Authorization in Apache Shiro"
}
GHSA-4CM7-7R9P-HQ66
Vulnerability from github – Published: 2022-12-15 21:30 – Updated: 2025-04-21 15:31
VLAI
Details
An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2, watchOS 9.2. A user may be able to elevate privileges.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-42849"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-15T19:15:00Z",
"severity": "HIGH"
},
"details": "An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2, watchOS 9.2. A user may be able to elevate privileges.",
"id": "GHSA-4cm7-7r9p-hq66",
"modified": "2025-04-21T15:31:10Z",
"published": "2022-12-15T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42849"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213530"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213535"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213536"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Dec/20"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Dec/26"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Dec/27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4CMX-HRQ9-C23P
Vulnerability from github – Published: 2018-08-15 20:03 – Updated: 2023-04-21 18:30
VLAI
Summary
Improper Authorization in aedes
Details
Versions of aedes before 0.35.1 does not respect its own authorization rules when a client sets a Last Will.
Recommendation
Update to version 0.35.1 or later.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "aedes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.35.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-3778"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:58:11Z",
"nvd_published_at": "2018-08-08T20:29:00Z",
"severity": "MODERATE"
},
"details": "Versions of `aedes` before 0.35.1 does not respect its own authorization rules when a client sets a `Last Will`.\n\n\n## Recommendation\n\nUpdate to version 0.35.1 or later.",
"id": "GHSA-4cmx-hrq9-c23p",
"modified": "2023-04-21T18:30:53Z",
"published": "2018-08-15T20:03:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3778"
},
{
"type": "WEB",
"url": "https://github.com/moscajs/aedes/issues/211"
},
{
"type": "WEB",
"url": "https://github.com/moscajs/aedes/issues/212"
},
{
"type": "WEB",
"url": "https://github.com/moscajs/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8"
},
{
"type": "PACKAGE",
"url": "https://github.com/moscajs/aedes"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Authorization in aedes"
}
GHSA-4CVM-W5CQ-5GHX
Vulnerability from github – Published: 2025-09-03 00:30 – Updated: 2025-09-03 00:30
VLAI
Details
A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-9835"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-02T22:15:33Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-4cvm-w5cq-5ghx",
"modified": "2025-09-03T00:30:56Z",
"published": "2025-09-03T00:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9835"
},
{
"type": "WEB",
"url": "https://github.com/ez-lbz/poc/issues/46"
},
{
"type": "WEB",
"url": "https://github.com/ez-lbz/poc/issues/46#issue-3354477952"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.322182"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.322182"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.641729"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4F4R-WGV2-JJVG
Vulnerability from github – Published: 2023-09-20 12:30 – Updated: 2023-10-27 19:00
VLAI
Summary
Quarkus HTTP vulnerable to incorrect evaluation of permissions
Details
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-vertx-http"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-vertx-http"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-vertx-http"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-undertow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-undertow"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-undertow"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-csrf-reactive"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-csrf-reactive"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-csrf-reactive"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-keycloak-authorization"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-keycloak-authorization"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-keycloak-authorization"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-4853"
],
"database_specific": {
"cwe_ids": [
"CWE-148",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-21T16:58:20Z",
"nvd_published_at": "2023-09-20T10:15:14Z",
"severity": "HIGH"
},
"details": "A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.",
"id": "GHSA-4f4r-wgv2-jjvg",
"modified": "2023-10-27T19:00:20Z",
"published": "2023-09-20T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4853"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/issues/35785"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/discussions/35940"
},
{
"type": "PACKAGE",
"url": "https://github.com/quarkusio/quarkus"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238034"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-002"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-4853"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7653"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6112"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6107"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5480"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5479"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5446"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5337"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5310"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5170"
},
{
"type": "WEB",
"url": "https://access.redhat.com/articles/11258"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Quarkus HTTP vulnerable to incorrect evaluation of permissions"
}
GHSA-4F6F-X4M3-RHQJ
Vulnerability from github – Published: 2022-05-12 00:00 – Updated: 2022-05-24 00:01
VLAI
Details
Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
Severity
6.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-29855"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-11T20:15:00Z",
"severity": "HIGH"
},
"details": "Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have \"undocumented functionality.\" A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.",
"id": "GHSA-4f6f-x4m3-rhqj",
"modified": "2022-05-24T00:01:44Z",
"published": "2022-05-12T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29855"
},
{
"type": "WEB",
"url": "https://www.mitel.com/support/security-advisories"
},
{
"type": "WEB",
"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0004"
},
{
"type": "WEB",
"url": "https://www.syss.de/pentest-blog/undocumented-functionality-backdoor-in-mitel-desk-phones-syss-2022-021"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/167547/Mitel-6800-6900-Series-SIP-Phones-Backdoor-Access.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Jun/32"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4F8G-77MW-3RXC
Vulnerability from github – Published: 2026-04-09 17:36 – Updated: 2026-06-08 23:25
VLAI
Summary
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`
Details
Impact
Gateway plugin HTTP auth: gateway widens identity-bearing operator.read requests into runtime operator.write.
Plugin HTTP routes using gateway auth could receive runtime write scopes even when the upstream trusted-proxy request only declared read.
OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
2026.1.29 - Patched versions:
2026.4.8
Fix
The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.
Verification
The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.
Credits
Thanks @smaeljaish771 for reporting.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42429"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-09T17:36:53Z",
"nvd_published_at": "2026-04-28T19:37:46Z",
"severity": "LOW"
},
"details": "## Impact\n\nGateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`.\n\nPlugin HTTP routes using gateway auth could receive runtime write scopes even when the upstream trusted-proxy request only declared read.\n\nOpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `2026.1.29`\n- Patched versions: `2026.4.8`\n\n## Fix\n\nThe issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.\n\n## Verification\n\nThe fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.\n\n## Credits\n\nThanks @smaeljaish771 for reporting.",
"id": "GHSA-4f8g-77mw-3rxc",
"modified": "2026-06-08T23:25:13Z",
"published": "2026-04-09T17:36:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-4f8g-77mw-3rxc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42429"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-gateway-plugin-http-authentication"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`"
}
GHSA-4F97-4VQ5-662M
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46
VLAI
Details
The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-36238"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-01T03:15:00Z",
"severity": "MODERATE"
},
"details": "The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check.",
"id": "GHSA-4f97-4vq5-662m",
"modified": "2022-05-24T17:46:02Z",
"published": "2022-05-24T17:46:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36238"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JRASERVER-72249"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.